# NGINX error log format documentation

**URL:** <https://www.ruby-forum.com/t/nginx-error-log-format-documentation/234987>\
**Category:** NGINX\
**Created:** [May 23, 2013, 8:48pm UTC](https://www.ruby-forum.com/t/nginx-error-log-format-documentation/234987 "2013-05-23T20:48:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [May 23, 2013, 8:48pm UTC](https://www.ruby-forum.com/t/nginx-error-log-format-documentation/234987/1 "2013-05-23T20:48:36Z")

</div>

Hey!

I want to parse NGINX error logs. However, I did not find any  
documentation concerning the used log format. While the meaning of some  
fields like the data is pretty obvious, for some it is not at all. In  
addition, I cannot be sure that my parser is complete if I do not have a  
documentation of all the possible fields. Since it seems you can change  
the access log format, but not that of the error log, I really have no  
idea how to get the information I need.

Is there such documentation?

I also posted this question on StackOverflow:

Thank you!

---

<div class="post-metadata">

**Author:** ![Jan\_Teske](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/22d042/32.png) [@Jan\_Teske](https://www.ruby-forum.com/u/Jan_Teske)\
**Post date:** [May 23, 2013, 9:32pm UTC](https://www.ruby-forum.com/t/nginx-error-log-format-documentation/234987/2 "2013-05-23T21:32:27Z")

</div>

On Thu, May 23, 2013 at 08:47:42PM +0200, Jan Teske wrote:

Hi there,

> I want to parse NGINX error logs. However, I did not find any  
> documentation concerning the used log format.

less src/core/ngx\_log.c

should probably show most of what you need. Combine that with

grep -r -A 2 ngx\_log\_error src

and looking at an error log and you should see that it is “a small  
number  
(five, I think) of fixed fields, followed by free-form text”.

> While the meaning of some  
> fields like the data is pretty obvious, for some it is not at all. In  
> addition, I cannot be sure that my parser is complete if I do not have a  
> documentation of all the possible fields. Since it seems you can change  
> the access log format, but not that of the error log, I really have no  
> idea how to get the information I need.

I (strongly) suspect that the error log line format details is not  
something that nginx wants to commit to holding stable.

If you want to do any more parsing than “free-form text after a handful  
of  
common fields”, then you’ll probably want to care about the version you  
are using. Or at least, flag an imperfectly-recognised line if anything  
doesn’t match what you expect.

> Is there such documentation?

It’s hard to beat the contents of src/ for accuracy.

Choose the “identifying” string in the line you care about, find the  
matching ngx\_error\_log call, and then see what free-form text it  
provides  
in the current version.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Jan\_Teske](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/22d042/32.png) [@Jan\_Teske](https://www.ruby-forum.com/u/Jan_Teske)\
**Post date:** [May 26, 2013, 11:20pm UTC](https://www.ruby-forum.com/t/nginx-error-log-format-documentation/234987/3 "2013-05-26T23:20:02Z")

</div>

That was helpful. Thank you!